logto-io/logto v1.19.0

on GitHub

User impersonation (RFC 8693: OAuth 2.0 Token Exchange)

Added support for user impersonation via Token Exchange:

• New Management API endpoint POST /subject-tokens to request a subject_token for token exchange use.
• Updated the OIDC POST /oidc/token endpoint with a new grant type urn:ietf:params:oauth:grant-type:token-exchange to exchange a subject_token for a user-impersonated access_token.

See User impersonation for more details.

Application level custom_data

Added a new arbitrary object field custom_data to applications. This field can store any additional information not defined in the standard Application schema.

Multiple app secrets management

Secure apps (machine-to-machine, traditional web, Protected) can now have multiple app secrets with expiration. This allows for secret rotation and provides an even safer experience.

Organization and application level branding

Organization logo

Now it's able to set light and dark logos for organizations. You can upload the logos in the organization settings page.

Also, it's possible to override the sign-in experience logo from an organization. Simply add the organization_id parameter to the authentication request. In most Logto SDKs, it can be done by using the extraParams field in the signIn method.

For example, in the JavaScript SDK:

import LogtoClient from '@logto/client';

const logtoClient = new LogtoClient(/* your configuration */);

logtoClient.signIn({
  redirectUri: 'https://your-app.com/callback',
  extraParams: {
    organization_id: '<organization-id>',
  },
});

The value <organization-id> can be found in the organization settings page.

If you could not find the extraParams field in the SDK you are using, please let us know.

Application level branding

You can now set logos, favicons, and colors for your app. These settings will be used in the sign-in experience when the app initiates the authentication flow. For apps that have no branding settings, the omni sign-in experience branding will be used.

If organization_id is provided in the authentication request, the app-level branding settings will be overridden by the organization's branding settings, if available.

Performance improvements

Support experience app server-side rendering

Logto now injects the sign-in experience settings and phrases into the index.html file for better first-screen performance. The experience app will still fetch the settings and phrases from the server if:

• The server didn't inject the settings and phrases.
• The parameters in the URL are different from server-rendered data.

Package build improvements

• Use tsup to build the connector packages. This will make the build process faster, and should not affect the functionality of the packages.
• User Vite for transpilation and bundling of the @logto/console, @logto/demo-app and @logto/experience packages. Removed ParcelJS and replaced with Vite. No breaking changes should be expected.

Bug fixes

Fix the jsonb update behavior of the PATCH /api/applications/{applicationId} endpoint

All the jsonb fields of the Application object should be updated in the replace mode instead of merge mode. This change will make the PATCH method more predictable and consistent with the Restful API design.

• Update the jsonb field update mode from merge to replace in the PATCH /api/applications/{applicationId} endpoint.
• Update the API jsonb field input parameters validation from partial to full in the PATCH /api/applications/{applicationId} endpoint.
• Affected fields: oidc_client_metadata, custom_client_metadata, protected_app_metadata and custom_data.

Fix some of the webhooks event payload alway returns API response status 404 issue

Affected webhook events: Role.Scopes.Updated, Organizations.Membership.Updates.

The API response status code returned from the webhook event payload was always 404. That was caused by inserting the webhook event payload before the API response context was set.

Since we only trigger the webhook when the event is successfully processed, so the status code should always be 2xx.

This issue have been fixed by moving the webhook event payload insertion after the API response context is set.

Other improvements

• The favicon for the dark theme now can be set in the sign-in experience branding settings.
• Add new password digest algorithms: Argon2d and Argon2id. Users with those algorithms will be migrated to Argon2i upon successful sign in.
• The browser list configuration for @logto/experience has been synced with what is stated in README.md.
• Improve swagger auth description. Use native OpenAPI OAuth2 security scheme instead of custom HTTP header-based security schema.